Skills Guide

Cut a proxyforward release

VerifiedSafe

Playbook for cutting a proxyforward release — a tag drives the pipeline, which stops at a draft you must smoke-test and publish by hand. Releases are an escalation trigger: confirm with the human first.

Download and use
Sby Skills Guide Bot
DevOpsIntermediate
7/23/2026
Claude CodeCodex
#release-management#github-actions#smoke-testing#windows#artifacts

Recommended for

Backend developerClaude CodeDevOps engineerCodexGit automation

Automated summary

Playbook for shipping a proxyforward release: pushing a tag triggers the GitHub Actions workflow, which deliberately stops at a draft you must smoke-test before publishing.

Strengths

  • Gives the exact git command sequence and explains what release.yml does (build, ldflags stamping, SHA256SUMS, SBOM, provenance attestation)
  • Enforces a concrete smoke test on downloaded artifacts (version output, launch, installer, loopback pair) instead of trusting the build
  • Calls out two real traps: a silently missing NSIS installer and unsigned binaries triggering SmartScreen

Limitations

  • Highly specific to the xeri/proxyforward repo on Windows, so little of it transfers as-is
  • Assumes a human is available to confirm the escalation and publish the draft in the GitHub UI
  • Does not cover release notes authoring or a rollback procedure
When to use it

Use when tagging and publishing a new proxyforward version and validating the draft artifacts before they go public.

When not to use it

Avoid for development builds, Linux/macOS releases, or any project whose pipeline differs from this one.

Security analysis

Safe
Quality score90/100

This is a release playbook that tags and pushes a git release, inspects CI-built draft artifacts, and publishes them manually. It involves consequential network operations, but explicitly requires human confirmation before tagging/publishing and contains no destructive, exfiltrating, obfuscated, or safety-disabling instructions.

No concerns found

How this analysis is made

Examples

Cut a release
Cut release v1.4.0 for proxyforward: make sure master is clean and CI is green, push the tag, then walk me through smoke-testing the draft artifacts.
Missing installer asset
The release workflow finished but the draft has no NSIS installer attached — figure out why and tell me whether it's safe to re-run.
Verify the exe
Download the draft proxyforward.exe and verify it: check --version matches the tag, launch it, and run gh attestation verify on the binary.

name: release description: Playbook for cutting a proxyforward release — a tag drives the pipeline, which stops at a draft you must smoke-test and publish by hand. Releases are an escalation trigger: confirm with the human first.

Cut a release (playbook F)

Cutting or tagging a release is an escalation trigger — confirm with the human.

.github/workflows/release.yml does the build. It stops at a draft on purpose: the smoke test below is the part that cannot be automated, and a draft is what gives you the chance to run it before anyone can download the binary.

  1. Clean tree on master; CI green (go test ./..., cd frontend && npm run build).
  2. Tag and push: git tag vX.Y.Z && git push origin vX.Y.Z. The workflow builds the exe and the NSIS installer, stamps the version via -ldflags into internal/version, asserts --version reports the tag, writes SHA256SUMS.txt and an SPDX SBOM, and attaches a build-provenance attestation.
  3. Smoke the draft's artifacts — download them, don't trust the build:
    • proxyforward.exe --version shows vX.Y.Z.
    • The exe launches to the wizard/console.
    • The installer installs, launches, and uninstalls.
    • A loopback pair (gateway + agent headless, docs/agent/commands.md) moves bytes.
  4. Publish the draft in the GitHub Releases UI.
  5. Update README + root CLAUDE.md if commands or claims changed.

What can go wrong

  • A missing installer is silent. wails build -nsis exits 0 and just skips the installer when makensis isn't on PATH, so the workflow installs NSIS itself and then asserts the file exists. If that assert fires, the toolchain broke — don't "fix" it by dropping -nsis.
  • The binaries are unsigned (no certificate). SmartScreen warns on first run. The honest substitute is the attestation: gh attestation verify <exe> -R xeri/proxyforward.
  • Windows only. The linux/macOS artifacts CI builds are never release assets — the engine can't start there (see the Reality check in CLAUDE.md).

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/cut-a-proxyforward-release-mrx3y02q/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/cut-a-proxyforward-release-mrx3y02q' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/cut-a-proxyforward-release-mrx3y02q/download' --output '.skill-downloads/cut-a-proxyforward-release-mrx3y02q/SKILL.md.part' && mv '.skill-downloads/cut-a-proxyforward-release-mrx3y02q/SKILL.md.part' '.skill-downloads/cut-a-proxyforward-release-mrx3y02q/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

This file does not provide a usable name/description header for this native procedure. It remains available to download and inspect; use the manual method below.

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/cut-a-proxyforward-release-mrx3y02q/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

Configure a Chat Channel with SecretRefs

DevOps

Set up chat channels using non-interactive commands, with secrets only as SecretRefs. Covers gather, mutate, repair, and prove steps for reliable delivery.

Claude CodeCodexintermediateSafe 387,940
Skills Guide Bot

Investigate ClickHouse CI Failures

DevOps

Investigate a ClickHouse CI failure end-to-end from a PR or S3 report URL. Fetches failed tests, classifies flaky vs real regression, and checks for existing issues/fixes.

Claude CodeadvancedSafe 49,516
Skills Guide Bot

Ansible PR Review

DevOps

Reviews an Ansible PR following the project's standardized process, including changelog checks, test coverage validation, and feedback tracking.

Claude CodeintermediateSafe 70,491
Skills Guide Bot